Call us now Email a specialist
+353 1 6420100 | info@ward.ie
  • Resources
  • Blogs
    • News

    Top six cyber issues surrounding COVID19 & what you…

    COVID-19: The top 6 cyber issues your Organisation faces and what to do about them

    It’s now a cliché but we live in unprecedented times. Organisations, people, societies are rapidly adapting to protect from COVID-19. The focus is correctly on protecting people, business and critical national services. Organisations are being forced to adopt new methods of working, new systems, new services and new streams of business, in timeframes and manners that would be inconceivable and potentially unsafe at any other normal time.
    Here are the top 6 notable observations that Ward Solutions are seeing at the moment, with respect to information and cyber security and our suggestions to address them.

    The Shift to capital “A” small “c” small “I”
    Cyber Security professionals were traditionally focused on Cia – Confidentiality (with a capital C) integrity and availability (small I, small a), perhaps reflecting an implied priority. The world right now seems focused on Availability with a capital A. Right now it’s about survival of organisations – Access to systems and services via the new remote working model is key, Integrity, confidentiality (compliance) as always really important seems to be taking a back seat in the fight for survival.

    Rapid deployment and adoption
    Prior to COVID19 organisations were working on strategic planned roll out of their IT and digital transformation strategies. In the last number of weeks some organisations have rolled out and adopted 2 years’ worth of IT work program and strategy in a highly accelerated manner to service their organisations for the new reality of COVID19. This has been achieved without the usual governance, security design, risk management, assurance and testing controls so carefully constructed by them to ensure order and control and to minimise downstream organisations risks.

    Budgets shot, inflight projects continue for now
    Most organisations are now rapidly scrambling to assess the financial and economic impact to their businesses. They need to spend money to put in place the key services that they need to continue to operate. Financial controllers are now trying to hoard cash as they can to hunker down for an indeterminate period of massive downturn, inevitably trying to rein in budgets and spend quickly until a “V” or “U” shaped recovery becomes apparent. Organisations still seem to be intent on continuing with key in-flight projects that they were working on. Presumably if they were in flight they were already a priority.

    Scamsters and Nation States may push stressed businesses over the edge
    Inevitably criminals, nation states will seize on chaos, fear, uncertainty, doubt to ply their toxic trade of malware laden websites, malware laden emails of COVID-19 topical interest, business email compromise, invoice redirection, social engineering to gain foothold in organisations. Glance in your inbox. The volume and nature of topical domains and URLs, COVID19 maps, “urgent” tenders, and rapid cures for Corona Virus is telling. Distracted, distributed staff, changed business process, rapidly adopted new systems, rapid untested changes to environments means that it’s going to be a really good year for the cyber criminals, badly intentioned Nation States and a bad year for highly stressed businesses. The costs and impact of a significant cyber event are already well known and will be a significant factor in pushing a high volume of already highly stressed organisations over the edge. This could have national and global impact on critical services such in Healthcare, life sciences, food production and distribution, utilities etc. at any time, but particularly during a pandemic/epidemic.

    Beware of John and Jane
    John and Jane are already highly stressed, worried about their family’s health, their employment security and their new way of working. John and Jane will be trying to get their job done come hell or high water, trying to find workarounds to new impediments presented to them in terms of rapid adopted new business processes and systems, limited access to files, systems, data, no physical access to their offices and work colleagues. Well intentioned short cuts and workarounds are inevitable. Inadvertent data loss, data breach, incorrect data production, data analysis are inevitable. Well intentioned John and Jane are inevitably highly vulnerable to scams. A malicious John and Jane are going to have a field day.

    COVID19 has shot holes in Business Continuity Plans
    The COVID19 crisis has exposed vulnerabilities in organisations with mature and immature business continuity plans alike. Organisations business continuity model had not anticipated the full likelihood and impact of global working from home, travel restrictions and dual work site, work force infections on a global scale in similar timelines. Invocation of remote working and business continuity has broadly succeeded in continuation of their business for now but has left a lot of organisations in a very vulnerable position in the medium term.

    The Top 6 things to do right now
    Re-establish control, governance and security strategy
    This is our new normal. Reestablish control by ensuring a systemic approach to ensure a secure IT environment. Go back to basics. Ensure that you gain an inventory of what has happened in your IT environment. There is a high likelihood that your users have resorted to “shadow IT services” to get the job done. Risk assess and test your organisations and put in place structured, prioritised mitigation planning and remediation. Ensure that new services and systems are incorporated into your security lifecycle. Don’t sacrifice strategic security initiatives when addressing short term tactical issues. There will inevitably be a recovery from COVID19 and organisations that are well set strategically will capitalise on that recovery best. Organisations that don’t have the right security strategy may not even survive the COVID19 crisis.

    Re-establish compliance & basic best practice security operations
    Make “c” a capital “C” again. Reestablish data protection, privacy and any of your other compliance and regulatory mandates that you have such as ISO, SOX etc. This will help de-risk financial or contractual risk and penalties. It will also benefit your customer, partner and employee relationships and trust. Put in place the basic IT and Cyber Security controls to secure and lockdown the new systems, new processes, new people/partners, new endpoints etc. Basic tasks such as security design review, secure implementation and hardening, assurance/testing, strong identity and access management, data protection, performing security operations of scanning, patching, monitoring and incident response. Review and test rule changes to firewall, new devices/endpoints.

    Review your processes,
    Your processes and work patterns have most likely changed. New systems may have been introduced. Workaround on original systems and processes are most likely the order of the day. Collegial proximity is now happening virtually or not at all. Original controls may no longer apply or if relevant may not be applied. A process risk assessment and audit as part of an overall risk assessment and security audit may need to be conducted and new control established or original controls re-applied, audited and monitored.

    Reeducate your people
    Your “human firewalls” are consistently your most effective security control. Right now they are stressed, over-worked, need an updated “rule set”, “threat intelligence” and enhanced “stateful inspection” capabilities. Educate them on the new work environments, their new processes and controls, the new risks that they face and how to deal with those risks. A blended approach always works best, so factor in time for tele-conferencing of instructor led, collaborative learning coupled with eLearning and policy toolsets. You may also need to consider enhanced defense in depth of your users, endpoints, web and email content controls to try and counter a mass upsurge in email scams and email and web borne malware.

    Ensure you have locked down, metered cloud services and licenses use
    Rapid adoption of new services such as cloud is point and click. Most cloud security incidents centre on a couple of key areas:
    • Failure to identify and inventory cloud services and shadow IT. Ensure that you audit and inventory cloud adoption and use. You may need cloud discovery audits to ensure you have a full inventory so you can apply policy and controls.
    • Failure to do due diligence on a cloud vendor and assume they are secure because they have lots of customers. In our experience Cloud vendors, big and small can have significant and fundamental security failings in their cloud offering.
    • Failure to understand the shared security responsibility in cloud services and an assumption that my cloud vendor has got my back from a cyber-security perspective. You need to understand what your vendor does and doesn’t do from a cloud security perspective and then take responsibility for and put appropriate controls in place for the pieces that are your responsibility.
    • Failure to implement security SKU’s and controls appropriately. Some vendors offer really good security features, which are often not appropriately secure by default. A rapid adoption of a cloud service by a relatively unskilled operator can literally leave buckets of critical or personal data open on the internet. Even skilled sysadmins make mistakes. So verification and validation of implementation is always required during build and operation.
    • Failure to understand, meter and limit cloud consumption and cloud usage can lead to unplanned and very rapid and expensive usage in a short period of time. Frequently users are oversold or over use beyond their actual requirements. Know your likely and most efficient consumption model and monitor your consumption and usage carefully and frequently to avoid unexpected or unsustainable costs.
    • Similarly, if you have mass adopted remote access or telecommunication or other collaboration services ensure that you are appropriately licensed. Be very careful of “introductory” no cost fees that drive mass adoption of a solution in vulnerable times but which may time expire, resulting in large unplanned fees at renewal or non-compliance with license terms. Temporary solutions have a habit of becoming permanent.

    Revisit and rebuild your Business Continuity
    Organisation need to reassess and remodel their disaster planning and business continuity plans based on what has emerged for COVID19 and its impact for the medium term. They then need invest in business continuity process and infrastructure to provide the new business continuity capabilities that are required. Organisation may also need to actively engage with Government contributing on national policies and investments related to critical national infrastructure and services that their organisations will now be heavily reliant on such as national broadband, power, healthcare, food security etc. for the future.

     

    As always, Ward Solutions will continue to Assess, Protect, Detect & Respond to your cyber security needs. If you need to contact Ward Solution on any matter, then:

    • Contact your normal account manager for sales or sales@ward.ie
    • Contact our orders department at orders@ward.ie
    • Contact our service delivery office at servicedeliveryoffice@ward.ie
    • Contact our Security Operations centre at SOC@ward.ie
    • Contact our Network Operation centre at NOC@ward.ie
    • Contact our finance department at Finance@ward.ie
    News

    COVID19 – How to stay Secure & Plan

    As the COVID19 Coronavirus situation develops and in light of latest Government recommendations we want to update and reassure all our clients about our commitment to keeping your business, you, our staff and our businesses safe and secure. We also want to reassure you about our plans for providing continuity of services to you and our commitment to help you with your needs as the situation develops

    Ward Solutions have been servicing clients nationally and internationally remotely, on client sites and from our offices as a normal part of our standard operations, since our foundation in 1999. Therefore we are expecting little change to our services and service levels to you as a result of our adherence to latest Government recommendations.

    We always take the health and wellbeing of all our staff very seriously and have been keeping a close track of developments relating to COVID19. Ward are a certified ISO 27001:2013 Information Security standard. We have a fully developed business continuity plan (BCP) in place, which is continuously reviewed, updated and ISO certified, which we have put into action in light of recent Government requests to allow where possible staff to work from remotely.

    Business continuity planning for COVID19 and Government guidance

    All our staff are briefed on how Ward Solutions plan to respond to the crisis and to our customers. All employees routinely test that the collaborative tools that we use remotely, broadband access, and mobile phone hotspots etc. all work effectively. We continuously capacity monitor and test our services in anticipation of greater volumes of staff working remotely and have significantly upgraded our facilities over the last 24 months to cater for increased volumes of staff, customers and services. Where client site remote access is required and agreed we use secure remote access to these customer sites. Staff can access these systems via their home broadband or via their company assigned mobile phones.

    If a member of staff needs to self-isolate, or a member of their family requires assistance, they generally can still work remotely. If a member of staff becomes sick, our contingency is to have another member of staff take over their work. Our service delivery office works with our project and service delivery management systems, our staff and clients to make sure projects and services continue as normal.

    In response to Government requests where possible we are working to increase the number of our staff working remotely. We are liaising with our clients to facilitate this request where BAU would normally be on client site. If on site is absolutely required then we are liaising with our clients to ensure that the appropriate controls and measures are in place to protect our staff, our clients staff, services and facilities.

    Should key personnel working on a particular client account become ill, we will inform that client in as timely a manner as possible. We will also provide contact details of the replacement consultant or engineer who will be looking after this account until the primary consultant recovers.

     

    Ward recommends some or all of the following

    Finally, as one of Ireland’s leading full service cybersecurity companys’, we also advise people to be on the lookout for some or all of the following:

    • Phishing, social engineering, invoice redirection and payment campaigns and scams designed to exploit the COVID-19 circumstances and exploit urgency, confusion, changes or weakness in controls that are occurring due to rapid change and evolution.
    • Malware campaigns exploiting the Coronavirus situation, e.g. malware laden emails, malware laden coronavirus web sites etc.
    • Vulnerabilities and exploits introduced through poor implementation or due diligence of rapid changes or the rapid introduction of new users, endpoints, networks, systems, cloud migrations etc.
    • Overload of detection, monitoring and response services resulting in missed incidents, offences or delayed response to incident and offenses resulting from changed user behavior and access patterns
    • Weakened physical security of buildings, facilities and services resulting from remote working, staff illness, normal staff turnover/replacement etc.

    From our experience we would recommend our customers and organisations to do the following:

    • Increase your user security awareness and training at this time and adapting it specifically for the changed circumstances you find yourself in
    • Ensure you only use trusted news sources for health and safety information about Coronavirus, such as the World Health Organisation (WHO) website and the European Centre for Disease Prevention and Control page and Ireland’s Department of Health.
    • Test and revise your business continuity plan – particularly with respect to availability to and performance of services and to ensure that secure (remote) access is provided and maintained to protect your and your client’s data.
    • Prioritise capacity, resources and quality of services for known critical services.
    • Perform appropriate security due diligence, security design and verification of any changes or new systems you introduce.
    • Ensure your security operations continue and are fully aware of, prepared for monitoring, adjust to changes that are occurring and are in a position to respond appropriately. This may require extra capacity and resources.
    • Augment or supplement your cyber and physical security staff, resources and services if necessary for temporary work and protection until business returns to a more normal state
    • Increase communication with staff, customers and suppliers and having appropriate collaboration, communication tools available to all staff, customers and partners to ensure BAU and to ensure that tools and protocols are in place and known for critical incident response

    In summary, despite being in uncertain times, Ward Solutions will continue to Assess, Protect, Detect & Respond to your cyber security needs. If you need to contact Ward Solution on any matter, then:

    • Contact your normal account manager for sales or sales@ward.ie
    • Contact our orders department at orders@ward.ie
    • Contact our service delivery office at servicedeliveryoffice@ward.ie
    • Contact our Security Operations centre at SOC@ward.ie
    • Contact our Network Operation centre at NOC@ward.ie
    • Contact our finance department at Finance@ward.ie
    News

    Penetration Testing Vs. Red Team Testing

    You might have read many of these already but here is our take on this:

    Many organisations carry out at least one or two pen-tests during the year.
    Here are 6 reasons to conduct a pen-test.

    What is a Pen-test?

    Penetration testing involves finding and exploiting as many vulnerabilities in your computer system. These tests are conducted in businesses to help identify the effectiveness of an organization’s vulnerability management program. These check whether an organisation’s networks, assets, platforms, hardware or applications are vulnerable to an attacker.

    What is a Red Team Penetration Test?

    These engagements are designed to achieve a specific goal using a simultaneous approach to gain access to sensitive server or business-critical application. They are heavily focused on emulating an advanced threat actor to identify gaps in the organisations defense strategy. A Red Team Pen Tests involves a lot more people, resources and time.

    Unlike Pen-tests where a blue team knows when these particular tests are conducted, in the case of red team penetration tests a company’s blue team are not aware when the assessment is taking place. During the engagement if a targeted company detects a red team activity, the blue team responds as if it were a real attack.

    How are they similar?

    Both these tests benefit the security posture of a business. They uncover the risks and vulnerabilities that an organisation faces within their security infrastructure. Most mature organisations who have already conducted scans, assessments and patches also do these rounds of tests.

    How are they different from each other?

    One of the main difference is the time factor, a pen test can take a few weeks or maybe about a month but a red team engagement is longer, it can take weeks, months or even years.

    An attack can happen at any second, but is a business ready for one?

    Penetration tests are standard while red team engagements involves constantly creating new tools and techniques to find their way into the system.

    The two reports are different; a red team is narrative than a pen test, which provides a list of findings. Here the details include steps on how the compromise took place like detailing the inspection, initial compromise, lateral movement and ex-filtration.

    Why should a business conduct a red team pen-test?

    A Red team penetration test shows how ready a business is for an attack, how do they detect and respond to a real case scenario.

    It depends on what your end objective is, if your business is about to launch an application or new site, a pen-test might work best for you to test and discover the security gaps for that app or site or project.

    If you want to assess your complete organisation’s security posture, a red team penetration testing engagement will be the best fit for you. Otherwise, you are looking to pay a higher cost by conducting individual tests, phishing campaigns and additional assessments.

    At the end, it depends on what works best for your business.

    If you want to know more about our service offering, click here.

    We do not want to preach about security but we want every individual in an organisation to practice it. If you would like to speak to our subject matter experts for further advice, call us: 1800 903 552 or e-mail us.

    News

    A cyber security strategy for 2020

    The other day someone tried to break into my apartment. The person barely managed to get through my room, he was only in for about 3-5 minutes, and heard me enter, when he ran into my balcony and escaped. The incident shocked me and made me reconsider an advanced security system at home.

    Security is part of our life now, we need to practice healthy security whether it is physical or your critical infrastructure. You never know when something bad can happen to you. Like the saying goes “It’s when you least expect it”.

    Let’s take scenarios on how security plays a part in two organisations:

    Case 1: You might be a business that is not too concerned about security and you might have just done a quick scan or may have carried out a pen-test two years ago thinking ‘yea that should be good enough’.

    There is a chance you might not have put aside a budget for security thinking it’s a huge investment. Now, that’s where things get messy because hackers are focused on the weaker targets.

    Solution: Good news is, if you have conducted a pen test or a quick scan, you are on the right track but you have a long way to go. To make it easy, contact a third party provider to help you plan your security stages for the year.

    The service most business consider to start with is a cyber-security risk assessment, which literally identifies and prioritizes the risks you face from high to low. We highly recommend you do the assessment. It will be worth every cent.

    Case 2: You might be a business who is afraid of a breach, so you have decided to take the umbrella route, which is to carry out all security practices, now you’ve exhausted your budget and you are absolutely certain that your business is 100% secure.

    The truth is there is never a business that is 100% secure.

    Here is why-

    Have a look at all the companies that had a breach in the last 12 months?
    They had a security team, maybe even third party vendors working with them and they followed best practices. What was that one security gap the hacker found?

    Solution: If you have invested heavily in security, we do not need to preach any further. Consider the following set of services, if you have not looked at it yet:

    Red Team Pen Testing- This kind of testing is more scenario driven and is heavily focused on advanced persistent threats. For eg; exploiting lost laptops, compromised DMZ hosts or unauthorized devices connected to internal network. The value that this engagement brings is you understand if your organisation can detect and respond to real world attacks.

    Managed Endpoint Detect and Respond (EDR)- Most advanced threats start on the endpoint. With Managed EDR solutions, you get to detect and assess any suspicious activity on the network of your endpoints. EDR solutions are best suited for a proactive cyber security approach.

    CISO as a service– Shortage of skills make it harder for many businesses. You need a whole team of experienced and highly skilled experts working with you and that is where we come in. We have a pool of resources you can choose from that best suit your needs.

    Download our Security Roadmap for 2020.

    If you are looking for an Information security consultant, you have come to the right place. Speak to our subject-matter experts to stay ahead of the security surface. We provide end-to-end security solutions that will protect your business from an attack.  Contact Us to discuss your unique requirement.

     

    News

    4th Generation Security Operations Centre

    Watch what happens inside our Security Operations Centre:

    Organizations are facing more cybersecurity challenges today and at any time in the past this transformation and new technologies introduce new risks the conventional security practices are unsustainable it’s clear that you need intelligent integrated and automated security solutions to handle the ever-increasing volume of threats that can strike at any time. At ward solutions we have the people, the know how and the technology to address those threats on a 24/7 365 basis, our next-generation managed security services assess, protect, detect and respond to security events that are happening in your network right now and in real time.

    Let’s take a look inside and see how this works.

    Continuously monitoring the threat landscape looking for new and advanced threats and gathering security intelligence information from a range of host, network security and cloud devices. Let’s talk to our SOC manager and see how we turned this data into actionable insights.

    L1 Analyst: There’s a machine in the finance department trying to connect to a command and control server it looks like we’re dealing with ransomware.

    SOC Manager: Okay show me that one screen and let’s run the ransomware playbook can I get a firewall block on traffic going to that server and let’s get isolated from the network.

    L2 Analyst: Okay putting that in now. Machine has been isolated and the user has been notified.

    SOC Lead: Thanks can we get an incident response notification out to the client please.

    SOC Manager: Send the IOCs to the threat-hunters so we can determine what happened here can we get a scan of that subnet using QVM.

    L1 Analyst: Okay, sending now.

    L3 Analyst: Got them! I’ll start hunting the carbon black ruled by Watson as well yes, it looks like petya.

    L1 Analyst: I’ve run a scan and there are multiple machines vulnerable to the CVE-2018-4878.

    L3 Analyst: Yeah, it appears the vulnerability was exploited using the RIG exploit kit, which is then used to install the Petya ransomware.

    L3 Analyst: Okay, I’ve done a scan on the remaining machines on the network and I can confirm the IOC’s do not exist anywhere else.

    SOC Manager: Well done everyone. We stopped this one in time let’s take that alert level down.

    SOC Lead: I have a call scheduled with the client in the incident room in five minutes.

    Call with Client

    SOC Lead: Just a quick update on your earlier incident, one of your machines in the finance department was infected with a ransomware. It originated a malicious email which then
    installed an exploit kit that in turn and installed the ransomware. So where are

    Client: Where are we at now Orla?

    SOC Lead: So the incidents been closed and the ransomware has been blocked. We found the exploit and patched the vulnerable machines which could have been compromised. We’re giving some recommendations to your IT team and the incident report will be with you shortly.

    It’s clear that you can’t avoid every cybersecurity attack but you must be able to swiftly deal with those that threaten your environment and that’s where we come in. Continuously monitoring your IT landscape detecting and responding to those threats providing you with security and peace of mind, managed security services from Ward solutions.

    Here is a high level incident response plan, view.

    If you would like to speak to our subject matter experts for further advice, call us: 1800 903 552 or e-mail us.

    News

    Security Advisory Notice – Windows RD Gateway and Windows…

    It has come to our attention that there is a security risk that could affect some customers. It involves Windows Remote Desktop Gateway (RD Gateway) and Windows Remote Desktop Client vulnerabilities.

    These vulnerabilities could allow an attacker to take over vulnerable Windows servers or Windows endpoints by initiating an RDP connection and sending specially crafted requests. If successfully exploited this code execution occurs at the level of the server and do not require authentication or user interaction. An attacker could then install programs, view, and change or delete data.

    Microsoft has released a High-level security advisory. They have said that there is a critical Windows RD Gateway and Windows Remote Desktop Client vulnerabilities – CVE-2020-0609, CVE-2020-0610, and CVE-2020-0611:

    • These vulnerabilities affect Windows Server 2012 and newer. In addition, CVE-2020-0611 affects Windows 7 and newer.

    Currently, “these vulnerabilities—in the Windows Remote Desktop Client and RD Gateway Server – allow for remote code execution, where arbitrary code could be run freely. The server vulnerabilities do not require authentication or user interaction and can be exploited by a specially crafted request. The client vulnerability can be exploited by convincing a user to connect to a malicious server.”[1]

    Windows RD Gateway Vulnerabilities – CVE-2020-0609/CVE-2020-0610

    • Affects all supported Windows Server versions (Server 2012 and newer; support for Server 2008 ends January 14, 2020);
    • Occurs pre-authentication; and
    • Requires no user interaction to perform.

    Windows Remote Desktop Client Vulnerability – CVE-2020-0611

    • CVE-2020-0611 requires the user to connect to a malicious server via social engineering, Domain Name Server poisoning, a man in the middle attack, or by the attacker compromising a legitimate server.

    Microsoft has already released software fixes to address this vulnerability as part of their monthly Patch Tuesday.

    We advise that you patch the affect machines ASAP by installing all January 2020 patches to effectively mitigate the vulnerability on all Windows 10 and Windows Server 2016/2019 systems.

    As of the time of this Security Advisory Notice we are unaware of active exploitation of these vulnerabilities. However, because patches have been publicly released, the underlying vulnerabilities can be reverse-engineered to create exploits that target unpatched systems.

    How do I Remediate?

    Apply the relevant patches for Windows RD Gateway Vulnerabilities – CVE-2020-0609/CVE-2020-0610 from the below links:

    Prioritise patching by starting with mission critical systems, internet facing systems, and networked servers. Organizations should then prioritize patching other affected IT/OT assets.

    Apply the relevant patch for Windows Remote Desktop Client Vulnerability – CVE-2020-0611 from the below link:

    Release Notes available here:

    How Can Ward Help?

    If you would like additional information or would like support in assessing and protecting your environment, please contact us.

    References:

    Alert (AA20-014A), Critical Vulnerabilities in Microsoft Windows Operating Systems, Available from:

    1. https://www.us-cert.gov/ncas/alerts/aa20-014a
    News

    Security Advisory Notice – Windows CryptoAPI Spoofing Vulnerability CVE-2020-0601

    It has come to our attention that there is a security risk that could affect some customers. It involves Windows CryptoAPI Spoofing Vulnerability in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Cryptography (ECC) certificate.
    This means that an attacker could create a certificate that would appear to be valid, allowing it to bypass the proper validation by a certificate authority. This could lead to further malicious activity from the attacker, allowing him for example to tamper on user connections, or inject, modify data without detection.
    Microsoft has released a High-level security advisory. They have said that there is a critical CryptoAPI Spoofing Vulnerability that exists in the following operating systems:
    • This vulnerability affects all machines running 32- or 64-bit Windows 10 operating systems, including Windows Server version 2016 and 2019.

    Currently, “this vulnerability allows Elliptic Curve Cryptography (ECC) certificate validation to bypass the trust store, enabling unwanted or malicious software to masquerade as authentically signed by a trusted or trustworthy organisation. This could deceive users or thwart malware detection methods such as antivirus. Additionally, a maliciously crafted certificate could be issued for a hostname that did not authorize it, and a browser that relies on Windows CryptoAPI would not issue a warning, allowing an attacker to decrypt, modify, or inject data on user connections without detection.”[1]

    Microsoft has already released software fixes to address this vulnerability as part of their monthly Patch Tuesday. We advise that you patch the affect machines ASAP by installing all January 2020 patches to effectively mitigate the vulnerability on all Windows 10 and Windows Server 2016/2019 systems.

    How do I Remediate?

    Apply the relevant patch from the below links:

    • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601 Prioritise patching by starting with mission critical systems, internet facing systems, and networked servers. Organizations should then prioritize patching other affected IT/OT assets.

    Release Notes available here:
    • https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/2020-Jan

    References:

    Alert (AA20-014A), Critical Vulnerabilities in Microsoft Windows Operating Systems, Available from:

    1. https://www.us-cert.gov/ncas/alerts/aa20-014a

    Further reading for detection measures provided by The National Security Agency (NSA):

    https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF

    How Can Ward Help?

    If you would like additional information or would like support in assessing and protecting your environment, please contact us.

    News

    Security Advisory Notice – Open CVE-2019-19781

    It has come to our attention that there is a security risk that could affect some customers. It involves a vulnerability in the Citrix Application Delivery Controller and the Citrix Gateway.

    A vulnerability  has been identified in Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that, if exploited, could allow an unauthenticated attacker to perform arbitrary code execution.

    The vulnerability has been assigned the following CVE number:

    CVE-2019-19781 : Vulnerability in Citrix Application Delivery Controller and Citrix Gateway leading to arbitrary code execution

    The vulnerability affects all supported product versions and all supported platforms:

    • Citrix ADC and Citrix Gateway version 13.0 all supported builds
    • Citrix ADC and NetScaler Gateway version 12.1 all supported builds
    • Citrix ADC and NetScaler Gateway version 12.0 all supported builds
    • Citrix ADC and NetScaler Gateway version 11.1 all supported builds
    • Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds

    How do I Remediate?

    Ward Solutions recommended that a responder policy is deployed as an interim solution, as a matter of urgency, until Citrix release a version where this vulnerability is fixed. Citrix has provided the following guideline to implement the responder policy to the Citrix servers as an interim solution:

    https://support.citrix.com/article/CTX267679

    How Can Ward Help?

    If you would like additional information or would like support in assessing and protecting your environment, please contact us.